Cryptography tools that never see your data

Abdessamad Bettal

encrypt.tools is designed, built and maintained by Abdessamad Bettal, a software engineer focused on applied cryptography and web security. The site exists because most online encryption and hashing tools send whatever you type to a server, which defeats the purpose of using them for anything sensitive.

Every guide on the site is written to the same standard as the tools: claims are sourced from the primary specifications (NIST FIPS and SP publications, IETF RFCs, OWASP), and every hash, ciphertext, key size and command shown is reproduced with OpenSSL or the algorithm's reference implementation before publication.

100% client-side

The site is a static application. When you open a tool, its code loads into your browser and all computation happens there — no tool makes a network request with your input. You can verify this yourself: open your browser's developer tools, switch to the Network tab, and use any tool. You can even disconnect from the internet after the page loads and the tools keep working.

Cryptography is never hand-rolled where a vetted implementation exists. The tools use:

• Web Crypto API — AES-GCM/CBC/CTR, RSA-OAEP, ECDSA, Ed25519/X25519, SHA-1/2, HMAC, PBKDF2 — implemented natively by the browser.
• @noble/hashes, @noble/ciphers, @noble/curves — SHA-3, BLAKE2/3, RIPEMD-160, Argon2, scrypt, ChaCha20-Poly1305, Salsa20 — audited, dependency-free TypeScript by Paul Miller.
• OpenPGP.js — PGP key generation, encryption and decryption — the library used by Proton Mail.
• bcryptjs — bcrypt hashing and verification.
• @scure/bip39 — BIP-39 mnemonic generation and validation (audited).

Simple, well-specified algorithms without a suitable library — MD5, MD4, CRC, Base-N encodings, ASN.1 parsing, RC4 and the classical ciphers — are implemented in small, readable TypeScript modules.

How outputs are tested

• Hashes, MACs and KDFs are checked against the official test vectors in their specifications (for example FIPS 180-4 for SHA-2, RFC 9106 for Argon2, RFC 4231 for HMAC, RFC 6238 for TOTP).
• Outputs are cross-checked against OpenSSL and reference command-line tools.
• Classical ciphers are checked against published worked examples.
• Tools that can't yet be verified against independent vectors aren't published — they stay marked “soon” in the directory rather than shipping unverified cryptography.

What this site is — and isn't

encrypt.tools is built for developers, students, security professionals and CTF players who need to encode, hash, inspect or experiment quickly. Some formats (like the AES and ChaCha20 tools' containers) are specific to this site. Legacy and broken algorithms — MD5, SHA-1, RC4, DES-era schemes, classical ciphers — are offered for interoperability and education and are clearly labelled. For protecting data long-term, use established software such as age, GnuPG, your operating system's disk encryption, or a password manager, and treat these tools as a way to understand and verify them.

Corrections and feedback

Found a bug, an incorrect output, or an error in a guide? Corrections are taken seriously and fixed quickly. See also the privacy policy.